Enum AnomalyKind 

pub enum AnomalyKind {
    ContentPurged {
        original_path: String,
    },
    PathTraversal {
        original_path: String,
    },
    DeletionTimeMissing {
        original_path: String,
    },
}

A Recycle Bin anomaly, with the offending evidence attached.

The reader keeps its typed reader output; this analyzer keeps its typed anomaly kind (domain knowledge) and converts to canonical findings.

Variants

ContentPurged

A $I index file with no paired $R content file: the metadata of a deleted file survives but its content has already been purged.

Fields

original_path: String

The original path recorded in the surviving $I.

PathTraversal

The original path stored in the $I file escapes its directory via ..\ (or ../) components — consistent with a crafted name rather than a normal shell deletion.

Fields

original_path: String

The offending stored path, surfaced verbatim for the investigator.

DeletionTimeMissing

The FILETIME deletion timestamp is zero — recorded but never set.

Fields

original_path: String

The path of the record whose deletion time is missing.

Implementations

impl AnomalyKind

pub fn code(&self) -> &'static str

Stable, scheme-prefixed machine code (a published contract).

pub fn severity(&self) -> Severity

Canonical severity for the anomaly.

pub fn category(&self) -> Category

Analytical lens for the anomaly.

pub fn note(&self) -> String

Human-readable, consistent-with note.

Trait Implementations

impl Clone for AnomalyKind

fn clone(&self) -> AnomalyKind

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for AnomalyKind

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for AnomalyKind

impl PartialEq for AnomalyKind

fn eq(&self, other: &AnomalyKind) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl StructuralPartialEq for AnomalyKind